General Data Protection Regulation (GDPR)

T-Blog Editor/ November 12, 2020/ Engage the experts, How-Tos and Other Useful Tips and Tricks, Industry News and Expert Advice, Tech Acronyms and Initialisms, Tech Definitions, Timeless Tips

Reading Time-approximately: 2 minutes

General Data Protection Regulation (GDPR) is legislation that will update and unify data privacy laws across the European Union. GDPR was approved by the EU Parliament on April 14, 2016 and goes into effect on May 25, 2018.

Posted by: Margaret Rouse

WhatIs.com

Contributor(s): Trea Lavery

GDPR replaces the EU Data Protection Directive of 1995. The new directive focuses on keeping businesses more transparent and expanding the privacy rights of data subjects. When a serious data breach has been detected, the company is required by the General Data Protection Regulation to notify all affected people and the supervising authority within 72 hours.

Mandates in the General Data Protection Regulation apply to all data produced by EU citizens, whether or not the company collecting the data in question is located within the EU, as well as all people whose data is stored within the EU, whether or not they are actually EU citizens.

Under GDPR, companies may not legally process any person’s personally identifiable information without meeting at least one of six conditions.

1. Express consent of the data subject.
2. Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
3. Processing is necessary for compliance with a legal obligation.
4. Processing is necessary to protect the vital interests of a data subject or another person.
5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

In addition, companies that conduct data processing or monitor data subjects on a large scale must appoint a data protection officer (DPO). The DPO is the figurehead responsible for data governance and ensuring the company complies with GDRP. If a company does not comply with the GDPR when it becomes effective, legal consequences can include fines of up to 20 million euros or 4 percent of annual global turnover.https://www.youtube.com/embed/ilLEdbfzw-I

Under the General Data Protection Regulation, data subject rights include:

Right to be forgotten – data subjects can request personally identifiable data to be erased from a company’s storage. The company has the right to refuse requests if they can successfully demonstrate the legal basis for their refusal.

Right of access – data subjects can review the data that an organization has stored about them.

Right to object – data subjects can refuse permission for a company to use or process the subject’s personal data. The company can ignore the refusal if they can satisfy one of the legal conditions for processing the subject’s personal data, but must notify the subject and explain their reasoning behind doing so.

Right to rectification – data subjects can expect inaccurate personal information to be corrected.

Right of portability – data subjects can access the personal data that a company has about them and transfer it.

Some critics have expressed concern about the United Kingdom’s upcoming withdrawal from the EU and wonder whether this will affect the country’s compliance with the GDPR. As of this writing, it is expected that the U.K. will update the Data Protection Act 1998 with a new law called the Data Protection Bill 2017. However, because companies in the U.K. often do business with customers or other organizations in EU member states, it is expected that businesses in the U.K. will still need to comply with the General Data Protection Regulation either directly or though an “adequacy test” acceptable to European authorities. 

Margaret Rouse asks:

How is your company preparing for GDPR compliance?

Join the Discussion